full-disclosure - Re: Windows .ANI LoadAniIcon Stack Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 1 Apr 2007 12:13:53 -0400
From: wac <waldoalvarez00@...il.com>
To: "Larry Seltzer" <Larry@...ryseltzer.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows .ANI LoadAniIcon Stack Overflow

On 4/1/07, Larry Seltzer <Larry@...ryseltzer.com> wrote:
>
> >>The issue is that this only works with DEP turned off!
>
> Interesting point. I haven't seen this mentioned anywhere, including the
> Microsoft advisory
> (http://www.microsoft.com/technet/security/advisory/935423.mspx).
>
> Has anyone actually tested this with DEP on/off to be sure?

Yes, winhex uses the function when you open the .ani and I don't have it
running with DEP turned on and the same goes for firefox that also leaves
the file openend when I openen  web link dev sent me (already tested winhex
with the address of exitprocess that btw seems to float around from system
to system since the version dev sent me does not works for me and it works
like a charm when I built it). I was talking with dev code about DEP
bypassing btw, we think that is possible to exploit even with >> DEP ON <<.
Just ideas for now.

Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.eweek.com/blogs/larry_seltzer/
> Contributing Editor, PC Magazine
> larryseltzer@...fdavis.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/